X Data Breach? Users Are Getting Flooded With Password Reset Emails Nobody Requested
X users are reporting waves of unsolicited password-reset emails, unfamiliar login alerts, and occasional temporary lockouts. The emails appear to be legitimate X messages, not spoofed. X says it is investigating, has found no evidence of a new breach, and suspects attackers are trying to gain control of accounts, possibly to access X Money. The activity may be driven by older leaked datasets and credential-stuffing rather than a fresh compromise. X-related email/phone datasets have circulated for years, and researchers have also observed large-scale botnets testing stolen credentials against X accounts. In parallel, phishing campaigns are sending fake X security alerts that mimic real login notices and try to steal passwords or app access. Security advice: verify sender addresses, enable authenticator-app 2FA, use a unique password, review active sessions and connected apps, and turn on X’s password-reset protection.
